CVE-2016-0904

High

Published: 21/09/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before version 7.3.0-233 use the same encryption key across different customers' installations, allowing remote attackers to defeat cryptographic protection mechanisms.

Risk Assessment

Attackers can gain access to sensitive client-server traffic information by leveraging knowledge of the encryption key from another installation, posing a serious threat to data security.

Recommendation

It is recommended to upgrade to version 7.3.0-233 or later to ensure unique encryption keys for each installation and enhance data security.

Other vulnerabilities in EMC Avamar Server

CVE-2016-0920High
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before version 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration.

Original NVD description (English source)

Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by leveraging knowledge of this key from another installation.